CVE-2025-30214CWE-200CWE-287

Frappe vulnerable to information disclosure leading to account takeover

High · published March 25, 2025

CVSS v4.0
8.0
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

The record
Technical detail
CVSS v4.0
8.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00415 · 34.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-287 · Improper Authentication
Published
2025-03-25T15:05Z
EPSS history
Timeline
  • 25 MAR 15:05Z
    Frappe vulnerable to information disclosure leading to account takeover
    cvelistv5